The Computational Supersingular Isogeny Problem Alfred Menezes NutMiC 2019 – 1
Goals of this talk 1. Highlight some of the complications with assessing the “cost” of known attacks on computational problems. 2. Highlight some of the difficulties in comparing the costs of classical and quantum attacks. 3. Justify key size recommendations for SIDH (and SIKE). – 2
Assessing hardness of comp. problems 1. Assess the cost of known attacks. There are many factors to consider: ◮ Running time (number of arithmetic operations) ◮ Parallelizability ◮ Space requirements ◮ Communication costs ◮ Possibility of custom-designed machines ◮ Quantum resources 2. Assess the possibility of new attacks in the future. – 3
RSA vs. ECC key sizes Running time of NFS for factoring n : O ( exp (1 . 923+ o (1))(log n ) 1 / 3 (log log n ) 2 / 3 ) . Cost assessment is complicated: ◮ Communication costs for sieving (best done in cache/RAM) ◮ Linear algebra does not parallelize well ◮ Possibility of specialized hardware (TWINKLE, TWIRL) In contrast, the cost of Pollard’s rho attack on the ECDLP in E ( F p ) is straightforward to assess: ◮ Expected running time is √ π n/ 2 ( n = # E ( F p ) ≈ p ) ◮ Perfectly parallelizable (van Oorschot-Wiener (VW)) ◮ Negligible storage ◮ Negligible communication costs – 4
RSA vs. ECC key sizes After much debate, NIST issued the following key size recommendations in 2005 (SP 800-57) based on the running time of the fastest known (classical) attacks: Bits of Block Hash RSA ECC security cipher function log 2 n log 2 p 80 SKIPJACK (SHA-1) 1024 160 112 Triple-DES SHA-224 2048 224 128 AES-128 SHA-256 3072 256 192 AES-192 SHA-384 7680 384 256 AES-256 SHA-512 15360 512 TLS 1.2: 2048-bit RSA or 256-bit ECC for key agreement. – 5
Grover’s search and AES Let F : { 0 , 1 } ℓ → { 0 , 1 } be a function such that: (i) F is efficiently computable; and (ii) F ( x ) = 1 for exactly p inputs x ∈ { 0 , 1 } ℓ . Grover’s Search (1996) is a quantum algorithm that finds an x ∈ { 0 , 1 } ℓ with F ( x ) = 1 in 2 ℓ / 2 /p 1 / 2 evaluations of F . Key recovery: Consider AES with an ℓ -bit key. Suppose that we have r known plaintext-ciphertext pairs ( m i , c i ) , where r is such that the expected number of false keys is very close to 0. Define F : { 0 , 1 } ℓ → { 0 , 1 } by F ( k ) = 1 if AES k ( m i ) = c i for all 1 ≤ i ≤ r ; and F ( k ) = 0 otherwise. Then Grover’s search (with p = 1 ) can find the secret key k in 2 ℓ / 2 operations. Grover’s search is often used to justify moving from AES-128 to AES-256. – 6
Quantum resource estimates (AES-128) Grassl-Langenberg-Roetteler-Steinwandt (PQCrypto 2016) ◮ # circuits: 1 ◮ # qubits: 2,953 ◮ # gates: 2 87 ◮ depth: 2 81 NIST: Quantum attacks are restricted to a fixed circuit depth, called MAXDEPTH. Plausible values for MAXDEPTH: ◮ 2 40 gates (approx. # of gates that presently envisioned quantum computing architectures are expected to serially perform in a year). ◮ 2 64 gates (approx. # of gates that current classical computing architectures can perform serially in a decade). ◮ 2 96 gates (approx. # of gates that atomic scale qubits with speed of light propagation times could perform in a millennium). The attack needs to be parallelized. – 7
Grover’s search doesn’t parallelize well Optimal strategy (Zalka 1999): Divide the search space into M subsets, each of size 2 ℓ /M . Each of the M processors performs Grover’s search on one subset. √ Running time (per processor): 2 ℓ / 2 / M . depth: 2 81 2 40 2 48 2 64 # circuits: 2 82 2 66 2 34 1 # qubits/circuit: 2,953 2,953 2,953 2,953 # gates/circuit: 2 87 2 46 2 54 2 70 Total # gates: 2 87 2 128 2 120 2 104 – 8
Quantum error correction Self-correcting quantum memory may not exist. Actively-controlled quantum memories: ◮ To protect a circuit of depth D and width W , a surface code requires Θ (log 2 ( DW )) physical qubits per logical qubit. ◮ The active error correction is applied arxiv.org/abs/1208.0928 with a classical processor in a regular cycle (e.g. once every 200 ns ). ◮ The overall cost of surface code computation is Ω (log 2 ( DW )) RAM operations per logical qubit per layer of logical circuit depth. ◮ Quantum error correction has large overhead. ◮ This explains why DW -cost is a realistic cost measure for a quantum algorithm. – 9
AES-128 security, revisited Quantum Classical # # 2 35 AES ops 2 40 depth: depth: 2 82 2 93 circuits: processors: qubits/circuit: 2,953 2 46 2 50 gates/circuit: gates/processor: 2 128 2 143 Total gates: Total gates: ◮ The 2 93 classical processors used for error correction could be repurposed to perform exhaustive key search in time 2 35 AES operations. ◮ It isn’t clear then that Grover’s search is more effective than classical exhaustive search in breaking AES-128. ◮ Nevertheless, since AES-256 is only marginally slower than AES-128, it is reasonable to move from AES-128 to AES-256. – 10
NIST Category 1 ◮ Any attack must require computational resources comparable to or greater than those required for key search on AES-128. ◮ ...with respect to all metrics that NIST deems to be potentially relevant to practical security. ◮ NIST intends to consider a variety of possible metrics, reflecting different predictions about the future development of quantum and classical computing technology. ◮ Fixed circuit depth (MAXDEPTH) ◮ Cost metric: Number of gates • 2 143 classical gates • 2 170 /MAXDEPTH quantum gates ( 2 130 quantum gates if MAXDEPTH = 2 40 ) ◮ Category 3 (AES-192): • 2 207 classical gates, 2 233 /MAXDEPTH quantum gates – 11
Hash function collisions: Grover Let H : { 0 , 1 } ∗ → { 0 , 1 } ℓ be an ℓ -bit hash function. ◮ A collision is a pair ( x, y ) with H ( x ) = H ( y ) and x ̸ = y . ◮ Define F : { 0 , 1 } ℓ + c × { 0 , 1 } ℓ + c → { 0 , 1 } by � 0 , if H ( x ) ̸ = H ( y ) , F ( x, y ) = 1 , if H ( x ) = H ( y ) and x ̸ = y. The expected number of collisions is ≈ 2 ℓ +2 c . ◮ Grover’s search with M processors can find a collision in time √ 2 ℓ / 2 / M . ◮ If M = 2 ℓ / 3 , the time is 2 ℓ / 3 . ◮ So, collisions for SHA-256 can be found in time 2 85 . 3 . – 12
Collision finding: Classical (VW) ◮ The fastest generic classic finding algorithm for finding a collision for f : S → S (where # S = N ) is due to van Oorschot-Wiener (VW). ◮ Let θ be the distinguishing probability for elements in S . π N/ 2 + 2 . 5 � � ◮ Expected time ≈ θ , Space ≈ θ π N/ 2 . – 13
Hash function collisions: VW The VW algorithm for finding a col- lision for H : { 0 , 1 } ℓ → { 0 , 1 } ℓ : ◮ Has expected running time � π 2 ℓ / 2 ≈ 2 ℓ / 2 ◮ Is perfectly parallelizable ◮ Has negligible storage ◮ Has negligible communication costs With M = 2 ℓ / 3 processors, a collision can be found in time 2 ℓ / 6 . (Grover’s search takes time 2 ℓ / 3 .) – 14
Hash function collisions: BHT Brassard-Høyer-Tapp (BHT) (1998) Fix x 1 , x 2 , . . . , x N ∈ { 0 , 1 } ℓ + c . Define F : { 0 , 1 } ℓ + c → { 0 , 1 } by � 1 , if H ( y ) = H ( x i ) and y ̸ = x i for some i, F ( y ) = 0 , otherwise . Grover’s search (one processor) finds a collision in time N + 2 ℓ / 2 /N 1 / 2 . If N = 2 ℓ / 3 , this time is 2 ℓ / 3 . Bernstein (2009) argued that BHT is inferior to VW since: ◮ Memory access is expensive (on the order of N 1 / 2 ). ◮ Quantum memory is expensive. – 15
NIST Category 2 ◮ Any attack must require computational resources comparable to or greater than those required for collision search on SHA-256. ◮ Cost metric: Number of gates • 2 146 classical gates ◮ Category 1: • 2 143 classical gates, 2 170 /MAXDEPTH quantum gates. ◮ “...NIST will assume that the five security strengths are correctly ordered in terms of practical security.” ◮ Category 4 (SHA-384): • 2 210 classical gates – 16
SIDH parameters Unauthenticated key agreement scheme (Jao & De Feo, 2011). ◮ Let p = 2 e A 3 e B − 1 be a prime with 2 e A ≈ 3 e B ≈ p 1 / 2 . ◮ Let E be a (supersingular) elliptic curve defined over F p 2 with # E ( F p 2 ) = ( p + 1) 2 . ◮ Then E ( F p 2 ) ∼ = Z p +1 ⊕ Z p +1 , whence E [2 e A ] , E [3 e B ] ⊆ E ( F p 2 ) . Let { P A , Q A } , { P B , Q B } be bases for E [2 e A ] , E [3 e B ] . ◮ Write ( ℓ , e ) to mean either (2 , e A ) or (3 , e B ) . Similarly for { P, Q } . ◮ For each order- ℓ e subgroup S of E [ ℓ e ] , there exists a degree- ℓ e (separable) isogeny φ S : E → E/S over F p 2 with kernel S . The isogeny is unique up to isomorphism and can be efficiently computed. ◮ Hence, the number of degree- ℓ e isogenies φ : E → E ′ is ( ℓ + 1) ℓ e − 1 ≈ p 1 / 2 . ◮ SIDH parameters: e A , e B , p, E, P A , Q A , P B , Q B . – 17
SIDH 1. Alice selects a random order- 2 e A point R A = m A P A + n A Q A and computes the isogeny φ A : E → E/A , where A = ⟨ R A ⟩ . Alice transmits E/A , φ A ( P B ) , φ A ( Q B ) to Bob. 2. Bob similarly transmits E/B , φ B ( P A ) , φ B ( Q A ) to Alice. 3. Alice computes φ B ( R A ) = m A φ B ( P A ) + n A φ B ( Q A ) and ( E/B ) / ⟨ φ B ( R A ) ⟩ . 4. Similarly, Bob computes ( E/A ) / ⟨ φ A ( R B ) ⟩ . 5. The compositions of isogenies E → E/A → ( E/A ) / ⟨ φ A ( R B ) ⟩ and E → E/B → ( E/B ) / ⟨ φ B ( R A ) ⟩ have kernel ⟨ R A , R B ⟩ . 6. The shared secret is the j -invariant of these curves. – 18
Recommend
More recommend
